Changeset 2366

Timestamp:

05/23/07 10:43:05 (1 year ago)

Author:

mrenzmann

Message:

Applying fixes in response to tickets #1270, #1334 and #1335 and
tagging the result as release-0.9.3.1.

Files:

• tags/release-0.9.3.1 (copied) (copied from tags/release-0.9.3)
• tags/release-0.9.3.1/THANKS (modified) (1 diff)
• tags/release-0.9.3.1/net80211/ieee80211_input.c (modified) (6 diffs)
• tags/release-0.9.3.1/net80211/ieee80211_node.c (modified) (2 diffs)
• tags/release-0.9.3.1/net80211/ieee80211_scan.h (modified) (1 diff)
• tags/release-0.9.3.1/net80211/ieee80211_var.h (modified) (1 diff)
• tags/release-0.9.3.1/net80211/ieee80211_wireless.c (modified) (4 diffs)
• tags/release-0.9.3.1/release.h (modified) (1 diff)

tags/release-0.9.3.1/THANKS

@@ -125 +125 @@
-Andrew Lunn
-Michael Plourde
+Md Sohail Ahmad
-
-Apologies to anyone whose name was unintentionally left off.

tags/release-0.9.3.1/net80211/ieee80211_input.c

@@ -694 +694 @@
-                        /* NB: assumes linear (i.e., non-fragmented) skb */
-
+                        /* check length > header */
+                        if (skb->len < sizeof(struct ether_header) + LLC_SNAPFRAMELEN
+                            + roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2) {
+                                IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
+                                        ni->ni_macaddr, "data", "%s", "decap error");
+                                        vap->iv_stats.is_rx_decap++;
+                                IEEE80211_NODE_STAT(ni, rx_decap);
+                                goto err;
+                        }
+
-                        /* get to the tunneled headers */
-                        ath_hdr = (struct athl2p_tunnel_hdr *)
-                                skb_pull(skb, sizeof(struct ether_header) + LLC_SNAPFRAMELEN);
-
-
+
+
+
+
+
+
+
+
+
-                                goto err;
-
+
+
-                        /* only implementing FF now. drop all others. */
-                        if (ath_hdr->proto != ATH_L2TUNNEL_PROTO_FF) {
@@ -713 +731 @@
-                        vap->iv_stats.is_rx_ffcnt++;
-                        
-                        /* move past the tunneled header, with alignment */
-                        skb_pull(skb, roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2);
-
-                        skb1 = skb_clone(skb, GFP_ATOMIC); /* XXX: GFP_ATOMIC is overkill? */
-                        eh_tmp = (struct ether_header *)skb->data;
-
-                        /* ether_type must be length*/
-                        frame_len = ntohs(eh_tmp->ether_type);
-
-                        /* we now have 802.3 MAC hdr followed by 802.2 LLC/SNAP. convert to DIX */
@@ -730 +741 @@
-                        /* prepare second tunneled frame */
-                        skb_pull(skb1, roundup(sizeof(struct ether_header) + frame_len, 4));
-                        eh_tmp = (struct ether_header *)skb1->data;
-                        frame_len = ntohs(eh_tmp->ether_type);
-                        athff_decap(skb1);
-
@@ -2735 +2744 @@
-                }
-
+                /* IEEE802.11 does not specify the allowed range for 
+                 * beacon interval. We discard any beacons with a 
+                 * beacon interval outside of an arbitrary range in
+                 * order to protect against attack.
+                 */
+                if (!(IEEE80211_BINTVAL_MIN <= scan.bintval && 
+                     scan.bintval <= IEEE80211_BINTVAL_MAX)) {
+                        IEEE80211_DISCARD(vap, IEEE80211_MSG_SCAN,
+                                wh, "beacon", "invalid beacon interval (%u)", 
+                                scan.bintval);
+                        return;
+                }
+                
-                /*
-                 * Count frame now that we know it's to be processed.
@@ -2862 +2884 @@
-                                memcpy(ni->ni_tstamp.data, scan.tstamp,
-                                        sizeof(ni->ni_tstamp));
-scan.bintval
+IEEE80211_BINTVAL_SANITISE(scan.bintval)
-                                ni->ni_capinfo = scan.capinfo;
-                                ni->ni_chan = ic->ic_curchan;
@@ -3286 +3308 @@
-                ni->ni_rstamp = rstamp;
-                ni->ni_last_rx = jiffies;
-bintval
+IEEE80211_BINTVAL_SANITISE(bintval)
-                ni->ni_capinfo = capinfo;
-                ni->ni_chan = ic->ic_curchan;

tags/release-0.9.3.1/net80211/ieee80211_node.c

@@ -665 +665 @@
-        ni->ni_rstamp = se->se_rstamp;
-        ni->ni_tstamp.tsf = se->se_tstamp.tsf;
-se->se_intval
+IEEE80211_BINTVAL_SANITISE(se->se_intval)
-        ni->ni_capinfo = se->se_capinfo;
-        ni->ni_chan = se->se_chan;
@@ -1217 +1217 @@
-                IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
-                memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp));
-sp->bintval
+IEEE80211_BINTVAL_SANITISE(sp->bintval)
-                ni->ni_capinfo = sp->capinfo;
-                ni->ni_chan = ic->ic_curchan;

tags/release-0.9.3.1/net80211/ieee80211_scan.h

@@ -131 +131 @@
-        u_int8_t fhindex;
-        u_int8_t erp;
-8
+16
-        u_int8_t timoff;
-        u_int8_t *tim;

tags/release-0.9.3.1/net80211/ieee80211_var.h

@@ -61 +61 @@
-#define IEEE80211_DTIM_DEFAULT  1       /* default DTIM period */
-
-5
+10
-#define IEEE80211_BINTVAL_MIN   25      /* min beacon interval (TU's) */
-#define IEEE80211_BINTVAL_DEFAULT 100   /* default beacon interval (TU's) */
+#define IEEE80211_BINTVAL_VALID(_bi) \
+        ((IEEE80211_BINTVAL_MIN <= (_bi)) && \
+         ((_bi) <= IEEE80211_BINTVAL_MAX))
+#define IEEE80211_BINTVAL_SANITISE(_bi) \
+        (IEEE80211_BINTVAL_VALID(_bi) ? \
+         (_bi) : IEEE80211_BINTVAL_DEFAULT)
-
-#define IEEE80211_BGSCAN_INTVAL_MIN     15      /* min bg scan intvl (secs) */

tags/release-0.9.3.1/net80211/ieee80211_wireless.c

@@ -1257 +1257 @@
-        struct ieee80211com *ic = vap->iv_ic;
-
-
-
-
-
-
-
-
+
+
-
-        if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
-                return -EOPNOTSUPP;
+        
+        if (wrq->disabled) {
+                if (ic->ic_flags & IEEE80211_F_PMGTON)
+                        ic->ic_flags &= ~IEEE80211_F_PMGTON;
+        } else {
-        switch (wrq->flags & IW_POWER_MODE) {
-        case IW_POWER_UNICAST_R:
-        case IW_POWER_ALL_R:
-        case IW_POWER_ON:
+                        if (wrq->flags & IW_POWER_PERIOD) {
+                                if (IEEE80211_BINTVAL_VALID(wrq->value))
+                                        ic->ic_lintval = IEEE80211_MS_TO_TU(wrq->value);
+                                else
+                return -EINVAL;
+        }
+                        if (wrq->flags & IW_POWER_TIMEOUT)
+                ic->ic_holdover = IEEE80211_MS_TO_TU(wrq->value);
+                        
-                ic->ic_flags |= IEEE80211_F_PMGTON;
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
-        return IS_UP(ic->ic_dev) ? ic->ic_reset(ic->ic_dev) : 0;
-}
@@ -2367 +2369 @@
-                    vap->iv_opmode != IEEE80211_M_IBSS)
-                        return -EINVAL;
-
-
+
-                        ic->ic_lintval = value;         /* XXX multi-bss */
-                        retv = ENETRESET;               /* requires restart */
@@ -3622 +3623 @@
-        struct ieee80211vap *vap = dev->priv;
-        int *param = (int *) extra;
-
+
+
-        int bss = param[2]; 
-        struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
@@ -3710 +3712 @@
-        struct ieee80211vap *vap = dev->priv;
-        int *param = (int *) extra;
-
+
+
-        struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
-        struct chanAccParams *chanParams = (param[2] == 0) ? 

tags/release-0.9.3.1/release.h

@@ -42 +42 @@
-#define RELEASE_VERSION SVNVERSION
-#else
-
+.1
-#endif